Update WordPress and WooCommerce without breaking your store: read changelogs, back up, test on a staging copy, update in a sensible order, know the auto-update defaults and how to recover.
To update WordPress and WooCommerce safely, take a backup you can restore, update a copy of your site first, test the pages that earn money, and only then repeat the same updates on the live store, in a quiet hour and with a way back. Updates close security holes and keep plugins working together, but they also change the code that runs your checkout. This guide gives you the routine, the automatic-update defaults and the recovery steps, as of October 2026.
In short
Updates carry security fixes, and WordPress's own advice is to always keep up to date: see the WordPress security checklist. WooCommerce's security patch policy says that for serious issues (a CVSS score of 9 or higher) fixes go to a rolling window of recent versions, roughly two years of releases, and that older stores must update to receive them. Updates also keep your software compatible: WooCommerce's update guide notes that compatibility often depends on the full set of active software, from theme to payment gateways.
In WordPress, a change in the first two numbers is a major release with new features, and a third number marks a minor release for fixes. WooCommerce's release calendar says it makes no distinction between major and minor releases: each one raises the version number, about every five weeks, and patch releases follow for problems found later. Treat every new WooCommerce version as a real change. Plugin and theme authors choose their own numbering, so a small number is no promise of a small change.
WordPress's upgrade handbook allows upgrading across many versions but suggests going step by step across more than two major releases. WooCommerce's guide advises against several major updates at once unless you tested that exact set.
wp-content, keep a copy away from the server and test a restore. See how to back up WordPress.| Flow | What to check |
|---|---|
| Product page | Price, images, variations and add to cart |
| Cart and checkout | Coupon, shipping and tax, then a test order with a test payment method |
| Emails | Order emails reach customer and admin and look right |
| Login | Login, My account and password reset |
| Admin | Orders screen, Tools > Site Health, failed items under WooCommerce > Status > Scheduled Actions |
On an Arabic or bilingual store, repeat the checks in Arabic: layout, emails and invoices, using the RTL checklist and the Arabic WordPress guide.
| Item | Default, per the WordPress documentation |
|---|---|
| Core, minor releases | On. The handbook strongly discourages turning it off |
| Core, major releases | On for new installations created on WordPress 5.6 or later (unless a version control checkout is detected). Existing installations keep minor-only unless enabled by an administrator, constant or filter. Change it under Dashboard > Updates |
| Plugins and themes | Off, apart from special security cases chosen by WordPress.org. Enable them per plugin in the Plugins screen's Automatic updates column, or per theme in its details |
| Translation files | On |
WordPress runs plugin and theme auto-updates (available since 5.5) twice a day by default, emails the site owner about successes and failures, and depends on WP-Cron, so Tools > Site Health shows an error if they cannot run. See the auto-updates documentation. Hosts may manage updates themselves, so check Dashboard > Updates for your real status.
WordPress also restores the previous version of a plugin if an update causes a fatal error: for manual updates since 6.3 and auto-updates since 6.6. That covers fatal errors only, not a checkout that quietly stops working. Our suggestion: keep minor core updates on, enable auto-updates only for small, low-risk plugins with automatic backups, and update WooCommerce, payment, shipping, tax and theme manually after testing.
wp-content/plugins and rename the folder of the plugin you just updated. WordPress deactivates plugins whose files are missing. The troubleshooting FAQ renames the whole plugins folder to plugins.hold instead. Rename it back afterwards and reactivate plugins one by one..maintenance file in the WordPress root folder, per the same FAQ.cd wp-content/plugins
mv example-plugin example-plugin.offReplace example-plugin with the real folder name, and reverse the rename to undo it. For symptoms such as a white screen, see fixing common WordPress errors.
WooCommerce suggests a monthly routine for most stores, and sooner for security fixes. Look at your own orders by hour and weekday, in your customers' time zone, and pick the quietest slot on a day when someone can fix a problem. Avoid campaign periods such as Ramadan offers or White Friday, and pause orders only briefly, for risky steps such as a database update.
Updates overwrite plugin and theme files, so never edit them. Put theme changes in a child theme, which survives parent updates; WooCommerce template overrides belong in its woocommerce folder, and WooCommerce > Status > System status flags outdated ones. Put snippets in a small plugin of your own, a folder in wp-content/plugins with one PHP file and a header comment (see the plugin basics), so they survive a theme change:
<?php
/*
* Plugin Name: My Store Customisations
*/The WordPress maintenance checklist turns this into a monthly routine.
WooCommerce suggests checking monthly and updating sooner for security fixes. WordPress minor releases arrive automatically by default, so the manual work is plugins, themes and WooCommerce.
WooCommerce's guide expects you to test on staging first, so manual updates fit best. WordPress advises having backups in place before enabling auto-updates at all.
Often yes, because WordPress supports upgrading across versions, but go step by step if you are more than two major releases behind, and test on staging first.
WooCommerce says to test on staging whenever possible. Without one, take a tested backup, update in a quiet hour in Coming soon mode, and test an order straight away.
Set up backups with how to back up WordPress, and read WooCommerce HPOS explained before you change how your store keeps orders. For plugins, see the best WooCommerce plugins and browse WordPress plugins on DevMarket, checking each item's update policy first.
Fix the WordPress critical error and white screen of death calmly: back up, read the logs, find the cause by elimination, then handle database, 500, memory, maintenance mode, 404 and login errors.
9 min read
Choose a WordPress theme by testing, not by demo. Compare block and classic themes, sources, speed, accessibility, RTL support, WooCommerce, builder lock-in and licence terms on a staging copy.
9 min read
Use this WordPress maintenance checklist to plan weekly, monthly and yearly tasks: updates, backups, users, plugins, security, speed, PHP, domain and SSL, plus Site Health and WooCommerce checks.
9 min read
Every item on DevMarket has a human-reviewed release, an instant licence key and clear update and support terms.